CCSP Practice Exam 52 — 20 Questions

Question 1

A multinational company headquartered in the US processes personal data of EU data subjects using a cloud service provider hosted in Singapore. Under GDPR, which legal mechanism is most appropriate for lawful transfer of personal data from the EU to Singapore?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Standard Contractual Clauses (SCCs). GDPR requires an appropriate safeguard for transfers to third countries without an adequacy decision. Standard Contractual Clauses (SCCs) are a common mechanism.

Answer

Binding Corporate Rules (BCRs)

Answer

Adequacy decision by the European Commission

Answer

Data Protection Agreement (DPA) with the cloud provider

Question 2

A global enterprise is conducting a cloud risk assessment. Which THREE factors should be considered? (Select three.)

Accepted Answer

Inherent risk of data leaving the on-premises environment. Inherent risk relates to data leaving premises. Provider control effectiveness is assessed via audit reports. Concentration risk is the risk of over-reliance on a single provider.

Answer

Color of the provider's logo

Answer

Provider's stock price

Question 3

According to GDPR, which THREE are data subject rights? (Select three.)

Accepted Answer

Right to object to processing for direct marketing. Under GDPR, data subject rights include the right to object to processing for direct marketing (Article 21), right of access (Article 15), and right to erasure (Article 17). Options A and E are also valid rights (right to portability is a data subject right), but the question asks for three specific rights from the list, and B, C, D are the correct set as per the intended answer.

Answer

Right to transfer data to a third country

Answer

Right to portability

Question 4

A cloud customer is preparing for litigation and needs to place a legal hold on specific data stored in an object storage service. The cloud provider offers features such as object lock and retention policies. What is the primary challenge the customer must address to ensure the legal hold is effective across all copies of the data?

Accepted Answer

Ensuring that the legal hold is applied to all copies of the data, including replicas and backups, and that the hold prevents modification as well as deletion.. In cloud environments, data may be replicated across multiple regions or stored in backups. A legal hold must prevent deletion or alteration of all copies, including replicas and backups. Failure to apply hold to all copies can result in spoliation.

Answer

Ensuring that the legal hold is time-limited and automatically expires after 90 days.

Answer

Verifying that the cloud provider has a backup of the data in a different geographic region.

Answer

Obtaining a court order that specifically authorizes the cloud provider to preserve the data.

Question 5

A cloud security team is investigating a data breach in their AWS environment. The logs show that an EC2 instance with an attached IAM role was compromised. The attacker used the instance's temporary credentials to access an S3 bucket containing sensitive data. Which design change would BEST prevent this type of attack in the future?

Accepted Answer

Enable IMDSv2 with a hop limit of 1 on the EC2 instance.. Enabling IMDSv2 with a hop limit of 1 forces the EC2 instance to use a session-oriented method to retrieve temporary credentials from the Instance Metadata Service (IMDS). This prevents SSRF attacks or other techniques that trick the instance into leaking its IAM role credentials, as the attacker would need to be on the instance itself to obtain the token. By setting the hop limit to 1, the metadata response is not forwarded beyond the instance's network interface, blocking remote access to the credentials.

Answer

Implement a network ACL that denies all outbound traffic from the EC2 instance to the S3 service.

Answer

Restrict S3 bucket access to the EC2 instance's private IP address only.

Answer

Disable public access on the S3 bucket using a bucket policy.

Question 6

A cloud customer is negotiating a contract with a new cloud provider. The customer wants to ensure they can maintain control over their data and verify the provider's security posture. Which TWO contractual provisions are most critical for these purposes? (Choose two.)

Accepted Answer

Data ownership clause specifying customer retains all rights to data. A data ownership clause explicitly states that the customer retains all rights, title, and interest in their data, ensuring legal control even when data is stored on the provider's infrastructure. This clause is foundational for maintaining data sovereignty and preventing the provider from claiming any ownership or usage rights over the customer's data.

Answer

Data portability clause to export data in a usable format

Answer

Data deletion clause for removal upon contract termination

Answer

Service Level Agreement (SLA) for uptime and performance

Question 7

An e-commerce company uses a cloud-based web application firewall (WAF) to protect against common web exploits. The security team notices that a specific IP address is sending a high volume of requests that appear to be a DDoS attack. What is the best immediate response to mitigate the attack while minimizing impact on legitimate users?

Accepted Answer

Implement rate limiting on the IP address with a threshold that allows normal traffic.. Rate limiting at the WAF allows the security team to restrict the volume of requests from the offending IP address without completely blocking it. This approach ensures that legitimate traffic from that IP (e.g., a shared NAT gateway or a user with a dynamic IP) can still pass through, while the DDoS attack traffic is throttled. WAFs typically support granular rate-limiting rules based on IP, session, or URI, making this the most precise and least disruptive immediate response.

Answer

Change the DNS to point to a different IP address.

Answer

Increase the compute capacity of the web servers.

Answer

Block the IP address in the WAF.

Question 8

An organization has a cloud environment with many accounts. They want to prevent any account from using certain services that are not approved (e.g., outside of a defined list). What is the BEST way to enforce this at the organizational level?

Accepted Answer

Apply a cloud governance policy at the organization level that denies the services.. Cloud governance policies at the organization level are the correct mechanism because they operate across all accounts, allowing centrally defined whitelists or blacklists of services. Unlike account-level access control policies, organizational policies set a permissions boundary that cannot be overridden by account administrators, ensuring that non-approved services are denied across the entire organization. This provides a preventive control that blocks the use of prohibited services before any action can occur.

Answer

Configure each account's access control policy to deny the services.

Answer

Enable a cloud configuration monitoring service to detect and disable non-approved services.

Answer

Use resource-specific access policies on each resource to restrict usage.

Question 9

Which CSA STAR tier involves a third-party assessment against ISO 27001?

Accepted Answer

Tier 2 – Third-party assessment. The CSA STAR (Security, Trust, Assurance, and Risk) program has three tiers: Tier 1 (Self-Assessment), Tier 2 (Third-Party Assessment), and Tier 3 (Continuous Monitoring). Tier 2 specifically requires a third-party assessment against the ISO/IEC 27001 standard, where an accredited certification body audits the cloud service provider's Information Security Management System (ISMS) for compliance. This tier provides a higher level of assurance than self-assessment, as it involves independent validation of security controls.

Answer

Tier 4 – Peer review

Answer

Tier 1 – Self-assessment

Answer

Tier 3 – Continuous monitoring

Question 10

During a security audit, it is discovered that a cloud application's API endpoints are vulnerable to injection attacks. Which defense in depth measure would be most effective in preventing such attacks?

Accepted Answer

Prepared statements in code. Prepared statements (parameterized queries) are the most effective defense against injection attacks because they separate SQL logic from user input, ensuring that input is treated as data only, never as executable code. This prevents attackers from manipulating query syntax, regardless of the input content. In cloud applications, this is a foundational secure coding practice that addresses the root cause of injection vulnerabilities at the application layer.

Answer

Web application firewall (WAF)

Answer

Rate limiting

Answer

Regular expression input validation

Question 11

An organization wants to encrypt data at rest in a cloud object storage service. Which control is appropriate?

Accepted Answer

Enable server-side encryption with a customer-managed key.. Server-side encryption with a customer-managed key (SSE-C) allows the cloud provider to encrypt data at rest in object storage using a key that the customer controls and manages. This ensures that the encryption process is handled by the service itself, but the customer retains control over key rotation, access, and revocation, which is appropriate for meeting compliance and security requirements for data at rest.

Answer

Implement a web application firewall.

Answer

Use a VPN for all access.

Answer

Enable TLS for all API requests.

Question 12

A cloud security architect is designing a DevSecOps pipeline for a multi-cloud environment. Which THREE practices should be included to ensure security is integrated early? (Select THREE)

Accepted Answer

Scanning dependencies for known vulnerabilities in the CI pipeline. Scanning dependencies for known vulnerabilities (e.g., using OWASP Dependency-Check or Snyk) in the CI pipeline catches vulnerable libraries before they are built into artifacts. This is a 'shift-left' practice that prevents insecure components from reaching later stages, aligning with DevSecOps principles of early security integration.

Answer

Scanning container images after they are deployed to production

Answer

Running DAST against the production environment

Question 13

Drag and drop the steps for implementing a cloud data encryption strategy using a customer-managed key (CMK) in AWS KMS into the correct order.

Accepted Answer

Create the CMK, then enable automatic key rotation, then set IAM permissions and key policies, then configure application integration, then monitor usage and audit logs.. The correct order starts with creating the CMK, then enabling rotation, setting permissions, configuring application integration, and finally monitoring usage.

Answer

Create the CMK, then set IAM permissions and key policies, then enable automatic key rotation, then configure application integration, then monitor usage and audit logs.

Answer

Set IAM permissions and key policies, then create the CMK, then enable automatic key rotation, then configure application integration, then monitor usage and audit logs.

Answer

Create the CMK, then enable automatic key rotation, then configure application integration, then set IAM permissions and key policies, then monitor usage and audit logs.

Question 14

A cloud architect is designing a data classification scheme for a SaaS application. Data must be classified based on sensitivity and regulatory requirements. Which of the following is the PRIMARY reason to classify data?

Accepted Answer

To apply appropriate security controls based on data sensitivity. The primary reason to classify data in a cloud environment is to enable the application of appropriate security controls based on data sensitivity. Classification drives the selection of encryption standards, access control policies, and data loss prevention (DLP) rules, ensuring that sensitive data receives stronger protection while lower-sensitivity data is handled with less restrictive measures. Without classification, security controls would be applied uniformly, leading to either over-protection of trivial data or under-protection of critical data.

Answer

To reduce storage costs by identifying obsolete data

Answer

To comply with a specific data protection regulation

Answer

To improve data access speeds for high-priority data

Question 15

A cloud security architect is designing a key management strategy for a multi-cloud environment. They want to ensure that encryption keys are generated and stored on-premises but can be used by cloud services for encryption operations. Which two key management models meet these requirements? (Choose two.)

Accepted Answer

Hold Your Own Key (HYOK). BYOK allows generating keys on-premises and importing them into cloud KMS. HYOK keeps keys on-premises and cloud services call back to the on-premises HSM for operations. Both involve keys originating on-premises.

Answer

Customer-Managed Encryption Key (CMEK)

Answer

Cloud provider default encryption

Answer

Client-side encryption

Question 16

Refer to the exhibit. A security engineer attaches this bucket policy to a cloud storage bucket. What does this policy accomplish?

Accepted Answer

It denies all requests to the bucket that are not using HTTPS.. The bucket policy uses a condition that checks for HTTPS usage (secure transport) and an explicit Deny effect. This denies any request that does not use HTTPS (i.e., plain HTTP), ensuring all traffic to the bucket is encrypted in transit.

Answer

It allows only requests from a specific virtual network endpoint.

Answer

It denies requests from IP addresses outside a specific range.

Answer

It denies all requests to the bucket.

Question 17

A financial services company is adopting a cloud-native microservices architecture. They want to ensure that only authorized services can communicate with each other, and that all inter-service communication is encrypted. Which of the following is the BEST approach?

Accepted Answer

Implement a service mesh with mutual TLS (mTLS) and fine-grained access policies. A service mesh with mutual TLS (mTLS) provides both encryption and identity-based authorization for inter-service communication. mTLS ensures that each service presents a valid certificate, proving its identity, and the mesh's control plane enforces fine-grained access policies (e.g., which services can call which endpoints). This directly meets the requirement for authorized, encrypted communication in a cloud-native microservices architecture.

Answer

Use network security groups to restrict traffic between service subnets

Answer

Connect services using VPC peering and enable encryption in transit

Answer

Deploy an API gateway and route all internal traffic through it

Question 18

A cloud operations team manages a critical application on AWS that uses EC2 instances behind an Application Load Balancer (ALB). The application experiences occasional high latency and timeout errors. The team has enabled detailed monitoring and CloudWatch Logs. They notice that during peak hours, the CPU utilization on some instances reaches 95%, while others remain around 40%. The security group allows traffic from a wide range of IP addresses. The team needs to improve both performance and security. Which of the following actions would BEST address the performance imbalance and also enhance security posture?

Accepted Answer

Create an auto scaling group with a dynamic scaling policy based on average CPU utilization, change the ALB to a Network Load Balancer for lower latency, and restrict the security group rules to the minimal required IP addresses.. It addresses both the performance imbalance and security posture. A dynamic auto scaling policy based on average CPU utilization automatically adjusts capacity to handle peak loads, balancing the load across instances. Changing to a Network Load Balancer (NLB) reduces latency due to its lower overhead compared to an Application Load Balancer (ALB). Restricting security group rules to minimal required IPs enhances security. Option A is incorrect because scheduled scaling may not match unpredictable traffic patterns, and sticky sessions can worsen imbalances. Option C is incorrect because increasing instance size is a static fix that doesn't address the imbalance during variable loads. Option D is incorrect because Classic Load Balancers lack advanced features like health checks and are not suitable for modern applications; round-robin alone doesn't fix the imbalance.

Answer

Schedule a periodic cron job to launch additional instances during expected peak hours and configure the ALB to use sticky sessions.

Answer

Increase the instance size to a larger type that can handle peak loads and reduce the security group to allow only known IP ranges.

Answer

Replace the ALB with a Classic Load Balancer and configure it to use round-robin routing without health checks to balance traffic quickly.

Question 19

A cloud security architect is designing network connectivity between multiple virtual networks in the same region. The requirement is to allow full mesh connectivity with centralized management and the ability to apply network policies. Which service should be used?

Accepted Answer

Transit gateway. A transit gateway acts as a central hub for multiple virtual networks, enabling transitive peering and centralized routing and policy management. Virtual network peering is point-to-point and does not support transitive routing, requiring a full mesh of connections for multiple virtual networks.

Answer

Internet gateway

Answer

Virtual network peering

Answer

Virtual network endpoint

Question 20

A company's security team is investigating an anomalous spike in outbound traffic from a cloud workload. The workload is a web server running in an IaaS environment. The team suspects data exfiltration. Which of the following is the BEST initial step to identify the source and type of traffic?

Accepted Answer

Enable VPC flow logs for the subnet hosting the workload and analyze the logs.. VPC flow logs capture metadata about all IP traffic to and from network interfaces in a subnet, including source/destination IPs, ports, protocols, and packet/byte counts. Analyzing these logs allows the security team to identify the external destination IPs and ports involved in the anomalous outbound traffic, which is the fastest way to pinpoint the source workload and characterize the exfiltration pattern without disrupting service or requiring agent deployment.

Answer

Immediately isolate the workload by blocking all outbound traffic in the security group.

Answer

Deploy a host-based intrusion detection system (HIDS) agent on the workload.

Answer

Run a vulnerability scanner against the workload to identify possible entry points.